Design

Let assume that Tandberg A is located on Public Internet.
And we want to allow it to place calls to Tandberg B, or say MCU on an internal network only through CUBE.
Let name the zone A - PUBLICINET-with-IPIPGW
And zone B - MCU

We also have to make some assumptions about the dial-plan.
Let assume that all endpoints on the internet side will have numbers starting with 00 and all endpoints on internal network will have numbers starting with 2.

00* <-----CUBE------> 2*

We also assume that CUBE has two IP addresses.
One IP should be public IP reachable form internet, and naturally it also should be reachable from inside of your network.
In this example the internet will be represented by the subnet 33.33.33.0/24
The internal network can have IP from any private subnet range as 10.x.x.x, 172.x.x.x or 192.x.x.x

33.33.33.0 - CUBE - 10.x.x.x

Configuration

1. First we need to register GW and the video endpoints to the GK and we can run GK feature on the same router if we have IOS with GK feature for example - C2800NM-IPVOICE_IVS-M.
The most simple setup will be if we register endpoints with full E164 numbers to their corresponding zones and register the CUBE to the GK in public zone.
The CUBE should be registered to the zone where we want to force your endpoints to use CUBE as an access point to your network, so it will be out Public zone with real IP reachable from Public Internet.

To have control over registration - we used "zone subnet" commands.
First we need them to disable registration of internal endpoints to the external zone.
And we also can use tighter restrictions - if we want to allow only some specific endpoints form internet to register the GK.
For example the command "zone subnet PUBLICINET-with-IPIPGW 33.33.33.101/32 enable" will allow to register endpoint with IP 33.33.33.101.

The matching CUBE config will be:

!

voice service voip
allow-connections h323 to h323

!

interface FastEthernet0/0
ip address 10.52.218.130 255.255.255.0

!
This interface is used only for routing, it is not involved in H.323 signaling.
!